[
https://issues.apache.org/jira/browse/TS-1075?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13288015#comment-13288015
]
Danny Shporer commented on TS-1075:
-----------------------------------
I have been thinking this over and you are right. Since the source/dest order
of the packets is always ingress or egress and never both (this is the fact I
was skipping), the kernel can properly identify the packets.
Thank you for the clarification.
I agree the the NAT firewall is a non-issue since that in itself is a
bottleneck on the port range.
The only minor issue to mention is trouble-shooting - when sniffing the NIC and
seeing the 2 identical streams (accept maybe some layer 7 changes which ATS may
have done - depending on the implementation) that could get confusing. But
that's definitly something we can live with.
Cheers
> Port range bottleneck in transparent proxy mode
> -----------------------------------------------
>
> Key: TS-1075
> URL: https://issues.apache.org/jira/browse/TS-1075
> Project: Traffic Server
> Issue Type: Bug
> Components: Core
> Affects Versions: 3.0.1
> Environment: Centos 5.6, kernel 2.6.39.2 compiled with TPROXY support
> ATS compiled as: ./configure --enable-tproxy
> Reporter: Danny Shporer
> Assignee: B Wyatt
> Fix For: 3.1.4
>
> Attachments: ports.patch
>
>
> The Linux TPROXY stack only takes into account the local addresses when using
> dynamic bind (bind without specifying a specific port). This limits the port
> range to only the local range (around 30K by default and can be extended to
> around 64K) - this together with the TIME-WAIT Linux method of releasing
> ports causes a bottleneck).
> One symptom of this is that traffic_cop cannot open a connection to the
> server to monitor it (it gets error 99 - address already in use) and kills
> it.
> Another issue is when opening the connection to the server.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
